From 418c256689fc6e37cf13780d78c77b3db3f30c2a Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Wed, 1 Feb 2017 12:45:53 +0000 Subject: [PATCH] Allow traffic to forward off the weave bridge --- weave | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/weave b/weave index 133daca9..d4c79e12 100755 --- a/weave +++ b/weave @@ -620,6 +620,10 @@ try_create_bridge() { # across our bridge. E.g. ufw add_iptables_rule filter FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT fi + # Forward from weave to the rest of the world + add_iptables_rule filter FORWARD -i $BRIDGE ! -o $BRIDGE -j ACCEPT + # and allow replies back + add_iptables_rule filter FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # create a chain for masquerading run_iptables -t nat -N WEAVE >/dev/null 2>&1 || true @@ -804,6 +808,8 @@ destroy_bridge() { run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dst $DOCKER_BRIDGE_IP --dport $PORT -j DROP >/dev/null 2>&1 || true run_iptables -t filter -D INPUT -i $DOCKER_BRIDGE -p udp --dst $DOCKER_BRIDGE_IP --dport $(($PORT + 1)) -j DROP >/dev/null 2>&1 || true + run_iptables -t filter -D FORWARD -i $BRIDGE ! -o $BRIDGE -j ACCEPT 2>/dev/null || true + run_iptables -t filter -D FORWARD -o $BRIDGE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true run_iptables -t filter -D FORWARD -i $BRIDGE -o $BRIDGE -j ACCEPT 2>/dev/null || true run_iptables -F WEAVE-NPC >/dev/null 2>&1 || true run_iptables -t filter -D FORWARD -o $BRIDGE -j WEAVE-NPC 2>/dev/null || true